The present invention relates in general to computer anti-virus detection and distribution and, in particular, to system and method for efficiently managing computer virus definitions using a structured virus database.
Computer viruses are program code usually causing malicious and often destructive results. All computer viruses are self-replicating. More precisely, computer viruses include any form of self-replicating computer code which can be stored, disseminated, and directly or indirectly executed. Computer viruses can be disguised as application programs, functions, macros, electronic mail attachments, and even applets and in hypertext links.
Computer viruses travel between machines via infected media or over network connections disguised as legitimate files or messages. The earliest computer viruses infected boot sectors and files. Over time, computer viruses evolved into numerous forms and types, including cavity, cluster, companion, direct action, encrypting, multipartite, mutating, polymorphic, overwriting, self-garbling, and stealth viruses, such as described in xe2x80x9cMcAfee.com: Virus Glossary of Terms,xe2x80x9d Networks Associates Technology, Inc., (2000), the disclosure of which is incorporated by reference. Most recently, macro viruses have become increasingly popular. These viruses are written in macro programming languages and are attached to document templates or as electronic mail attachments.
Historically, anti-virus solutions have reflected the sophistication of the viruses being combated. The first anti-virus solutions were stand-alone programs for identifying and disabling viruses. Eventually, anti-virus solutions grew to include specialized functions and parameterized variables that could be stored in a data file. During operation, the data file was read by an anti-virus engine operating on a client computer. Finally, the specialized functions evolved into full-fledged anti-virus languages for defining virus scanning and cleaning, including removal and disablement, instructions.
Presently, most anti-virus companies store the anti-virus language code for each virus definition into data files. For efficiency, the source code is compiled into object code at the vendor site. The virus definitions, including the object code, are then stored into the data files. To speed virus detection, the virus definitions are organized for efficient retrieval often as unstructured binary data.
Anti-virus companies are continually discovering new computer viruses on a daily basis and must periodically distribute anti-virus software updates. Each update augments the data file with new computer virus definitions, as well as replacing or deleting old virus definitions. Over time, however, the size of the data files tend to become large and can take excessive amounts of time to download. Long download times are particularly problematic on low bandwidth connections or in corporate computing environments having a large user base.
Consequently, one prior art approach to decreasing anti-virus data file downloading times determines and transfers only the changes between old and new data files. The anti-virus company first compares old and new data files and forms a binary delta file. The delta file is downloaded by users and a patching utility program converts the old data file into the new data file by replacing parts of the binary data file. While this approach can often decrease the amount of data to be downloaded, the sizes of the delta files are arbitrary and vary greatly, depending upon the differences in binary data. In the worst case, the old and new data files are completely different and the delta file effectively replicates the new data file, thereby saving no download time.
Therefore, there is a need for an approach to managing virus definitions in structured fashion for allowing efficient updating. Preferably, such an approach would store virus definitions maintained as indexed records in a database management system. Such an approach would allow efficient virus definition record addition, replacement, and deletion with minimal and controllable download times.
The present invention provides a system and method for storing, distributing, and accessing computer virus definition data using a structured virus database. On a client, a structured virus database is maintained for storing virus definition records. Each record has a unique identifier, one or more virus names, and object code xe2x80x9csentencesxe2x80x9d defining operations for detecting the presence of and for removing a compute virus. The operations are executed by an anti-virus engine to effect computer anti-virus protection. Periodically, updated master structured virus databases are retrieved. Preferably, the retrieved databases only contain the new or changed virus records. Each of the records is processed to add, delete, or replace records in the database.
An embodiment of the present invention is a system and method for efficiently managing computer virus definitions using a structured virus database. One or more virus definition records are stored in a structured virus database. Each virus definition record includes an identifier uniquely identifying a computer virus, at least one virus name associated with the computer virus, a virus definition sentence including object code providing operations to detect the identified computer virus within a computer system, and a virus removal sentence including object code providing operations to clean the identified computer virus from the computer system. The virus definition records in the structured virus database are accessed indexed by the identifier and the at least one virus name for each virus definition record. The object code of the virus definition sentence and the virus removal sentence for each accessed virus definition record is interpreted.
Still other embodiments of the present invention will become readily apparent to those skilled in the art from the following detailed description, wherein is described embodiments of the invention by way of illustrating the best mode contemplated for carrying out the invention. As will be realized, the invention is capable of other and different embodiments and its several details are capable of modifications in various obvious respects, all without departing from the spirit and the scope of the present invention. Accordingly, the drawings and detailed description are to be regarded as illustrative in nature and not as restrictive.